3 ms·
You eventually have to roll over keys at least once every N years, so if you are automating it, the length of time doesn't really matter. In this case, they ar
by savant 11y ago
You eventually have to roll over keys at least once every N years, so if you are automating it, the length of time doesn't really matter.
In this case, they are just limiting the window.
- kentonv 11y agoIndeed, we were going to do the auto-renewal regardless, so making it every 7 days didn't really add any work. Meanwhile I really am paranoid about long-lived keys of any sort, especially if they need to be online as TLS keys must. I wish CAs offered short-lived keys more readily (and web infrastructure supported it); I'd love to enable them for all Sandstorm properties.